Privacy Policy

1. Consent

By using the Services, you agree to us handling your personal information as set out in this policy. We will ask for your separate consent before collecting dietary information, using your location or camera, sending marketing, or contacting you for research. You can withdraw consent at any time in your settings, but some features may stop working. You must be at least 16 years old on the date of creation to create an account.

2. What we collect

• Account: first and last name, date of birth, email, password or whether you signed in with Google or Apple, age, and mobile number (for verification and account updates).
• Shopping and spending: supermarkets, shopping habits, budget, spending habits, priorities and the supermarket loyalty programmes you belong to.
• Contextual information (optional): your ethnicity, your dietary needs, the number and dietary needs of people in your household (not names or other identifiable information unless you have obtained consent to do so).
• Activity: searches, scans, your Shopping List, shared lists and optimisation results.
• Subscription: plan, dates and payments. Payments are handled by [the App Store / Google Play], and we never see your card details.
• Location: your postcode and, with your permission, your device location while the app is open.
• Device and usage: device type, app version, IP address, crash reports and how you use the app.

Dietary and household information can be health information. We treat it as sensitive, it is optional, and we never sell it or use it for advertising. Ethnicity is also optional and never required to use the Services.

We may also receive information from Google or Apple (if you sign in with them), the app stores, analytics providers, and other users who share a list with you. If we do, we will let you know as the Privacy Act requires.

3. How we use it

We use your information to run your account, check products against your profile, show relevant supermarkets and prices, optimise your Shopping List, manage your subscription, keep the Services secure, prevent misuse, and improve the Services. We will update this policy before using your information for anything new.

Analytics: we analyse the information we collect to understand how Those. is used and to improve it. This includes your first and last name, email, whether you signed in with Google or Apple, device information, location information, postcode, shopping habits, spending habits, dietary preferences, loyalty programmes, household size and ethnicity (if provided). Where practicable, we carry out this analysis on de-identified data. We do not currently share analytics with anyone outside Those., and will update this policy before we do.

4. Product results

We use automated tools, including AI, with human review to check each product against your profile, shown as a traffic light for each dietary need: green (Suitable) means the available information indicates the product meets that need; amber (Not yet confirmed) means there is not enough reliable information to say either way, and you should not assume it is suitable; and red (Unsuitable) means the product does not meet that need. Results are never influenced by payment.

Results are not medical or dietary advice. Product, ingredient, allergen and price information comes from third parties and may be wrong, incomplete or out of date, and a green result does not guarantee a product is safe for you. Always check the label.

5. Sharing

We do not sell your personal information or share it with supermarkets or brands. We only share it with service providers who help run the Services (listed at [insert link]), people you share a list with, our professional advisers, a buyer of our business (who must protect it the same way), authorities where the law requires, or with your permission.

6. Storage, security and retention

Some providers store data outside New Zealand, including in [insert countries]. We remain responsible for it, and any overseas disclosure will comply with the Privacy Act.

We use reasonable safeguards, including encryption and restricted access to dietary and household information. If a breach is likely to cause you serious harm, we will tell you and the Privacy Commissioner as soon as practicable.

When you delete your account, we delete or anonymise your personal information within [90] days. We may keep anonymised information that can no longer identify you, and use it for our ongoing improvement processes. Payment records are kept for 7 years because tax law requires it.

7. Your rights

You can ask to access or correct your information, or edit most of it in the app. We will respond within 20 working days, usually free of charge. You can remove your dietary or household information from your profile, or delete your account, at any time in [insert settings location] (see clause 6). Deleting the app does not close your account or cancel your subscription.

8. Messages, research and cookies

We send account, security and subscription messages while you have an account. Marketing is opt-in, and every message has an unsubscribe link. Research or feedback contact, including by phone, needs your separate consent. We never publish your feedback, name or photo without permission.

We use cookies and similar tools to run the app and understand how it is used. You can manage them in your settings.

9. Children

We only use a child’s household information to personalise your account, and never contact or market to children. Accounts held by anyone under 16 will be closed and their information deleted.

10. Changes and contact

We will give you at least 10 days’ notice of any important change to this policy. For questions, requests or complaints, contact our Privacy Officer at legal@pico.kiwi. If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner at www.privacy.org.nz or 0800 803 909.